Summary
| Parameter | Value |
|---|---|
| CVE ID (lead entry) | CVE-2026-78509 |
| Vulnerabilities covered | 2 (CVE-2026-78509, CVE-2026-78510) |
| Alert source | GitHub Advisory - critical vulnerabilities |
| CVE year | 2026 |
| Publication date | 2026-09-08 |
| Vendor | Microsoft |
| Product | Office — Outlook and Word |
| Versions affected | Microsoft 365 Apps, Microsoft 365, Office 2016, 2019, 2021, 2024 |
| CVSS Score | 9.8 (Critical) — both |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Microsoft’s September patch release contains two critical vulnerabilities in Office applications. Both belong to the same class — heap-based buffer overflow — and both allow an unauthenticated attacker to execute code over the network.
| CVE | Application | Vulnerability class | Impact |
|---|---|---|---|
| CVE-2026-78509 | Microsoft Office Outlook | heap-based buffer overflow | unauthenticated remote code execution |
| CVE-2026-78510 | Microsoft Office Word | heap-based buffer overflow | unauthenticated remote code execution |
Why a word processor flaw earns a score usually reserved for servers. The 9.8 rating comes from the fact that the attack needs no authentication and no prior foothold, and its impact is code execution. Office applications are in an unusual position: their normal work is processing content prepared by a stranger. Outlook receives messages from unknown senders by design; Word opens documents sent in from outside. A bug in the code that parses that content means the mere arrival of a file or message at the user becomes the start of an attack — without anything having to be broken along the way.
This inverts the usual hierarchy of importance. A server can be hidden behind segmentation and a firewall; a workstation running Outlook is meant to be reachable by mail from the entire world, because that is its purpose.
What we are not claiming. The precise exploitation conditions for each of these vulnerabilities — including whether any user interaction is required, and what kind — are documented by Microsoft in the MSRC portal. That is the authoritative source, and it is worth opening before deciding on priority rather than relying on intuition about “attachments”.
Neither vulnerability is currently in the CISA KEV catalog, and there are no public reports of exploitation.
Required Actions
- Install the September updates for every Office variant present in the organisation — both Microsoft 365 Apps and the perpetual-licence versions (2016, 2019, 2021, 2024).
- Check the Microsoft 365 Apps update channel. Semi-annual channels receive fixes later than the current channel. For 9.8-rated vulnerabilities, staying on a slower channel should be a deliberate decision, not the result of nobody ever changing the default.
- Do not overlook perpetual installations. Office 2016 and 2019 still turn up on individual workstations, outside the main subscription management mechanism. Those are the ones most often left unpatched, because they do not appear in the Microsoft 365 console report.
- Verify that the patch actually installed. Office applications require all windows to be closed to finish updating. A user who has had Outlook open for three weeks has a downloaded but unapplied fix.
- Review mail and document filtering rules. The mail gateway layer and attachment sandboxing do not replace the patch, but they reduce the number of attempts that reach the mail client at all.
Who Is Affected?
The vulnerabilities affect Microsoft 365 Apps, Microsoft 365, and Office 2016, 2019, 2021 and 2024 — practically the whole supported range, across both licensing models.
In practice this means every organisation whose staff use Outlook and Word, which in the mid-size and large company segment is the default suite. There is no narrow target group here and no optional role to disable; updating is the only route.
Particular attention is warranted for workstations where Office runs with administrative privileges, and for the machines of people who process large volumes of externally sourced documents — sales, HR, front office, finance. That is where the likelihood of a crafted file arriving at all is highest.
Sources
- NVD - CVE-2026-78509
- NVD - CVE-2026-78510
- Microsoft MSRC - CVE-2026-78509
- Microsoft MSRC - CVE-2026-78510
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
